topic Re: ASA 9.12 how to remove an ACL line in Network Security

ASA 9.12 how to remove an ACL line

ivanDmi — Thu, 21 Mar 2024 03:24:10 GMT

Hi All

Have just come across an odd problem. Need to remove couple of lines from an existing ACL, however, there seem to be a limitation of some sort as there's no option to specify the ACL name, this is ASA 9.12 (same on 9.14, 9.16):

(config)# no access-list ?

configure mode commands/options:
alert-interval Specify the alert interval for generating syslog message
                  106001 which alerts that the system has reached a deny flow
                  maximum. If not specified, the default value is 300 sec
deny-flow-max   Specify the maximum number of concurrent deny flows that can
                  be created. If not specified, the default value is 4096

At the same time, a 9.0 ASA works as expected:

(config)# no access-list ?

configure mode commands/options:
WORD < 241 char Access list identifier
alert-interval   Specify the alert interval for generating syslog message
                   106001 which alerts that the system has reached a deny flow
                   maximum. If not specified, the default value is 300 sec
deny-flow-max    Specify the maximum number of concurrent deny flows that can
                   be created. If not specified, the default value is 4096

There seem to be no differences in AAA config, I access both ASA with privilege level 15.

To make things even more complicated, I can modify ACLs via ASDM and with "preview commands" option selected, the ASDM seem to generate lines exactly as expected, i.e. "no access-list TEST-ACL extended permit tcp any any eq https"

Thanks!

Re: ASA 9.12 how to remove an ACL line

MHM Cisco World — Thu, 21 Mar 2024 04:13:21 GMT

Try use inactive first then remove the ACL line

MHM

Re: ASA 9.12 how to remove an ACL line

Aref Alsouqi — Thu, 21 Mar 2024 14:02:32 GMT

Did you actually try to type in the whole command even if it's weirdly not showing you the access list option? based on Cisco doc it should still work in the same way on 9.12:

CLI Book 2: Cisco ASA Series Firewall CLI Configuration Guide, 9.12 - Access Control Lists [Cisco ASA 5500-X Series Firewalls] - Cisco

Re: ASA 9.12 how to remove an ACL line

MHM Cisco World — Thu, 21 Mar 2024 14:11:27 GMT

I check in my lab with and without inactive the NAME of ACL must appear
so try reboot the ASA and check again or use inactive only without remove ACL

MHM

Re: ASA 9.12 how to remove an ACL line

AHack210 — Thu, 21 Mar 2024 19:52:57 GMT

Hi,

Try

show run access-list

And see what you actually have on the device.

HTH,

-A

Re: ASA 9.12 how to remove an ACL line

ivanDmi — Thu, 21 Mar 2024 22:39:32 GMT

Hi Aref,

Thanks for your response.

Typing the full "no access-list ACLNAME parameters" actually worked and the ACL line gets removed as expected. I thought I tried it and it failed but perhaps I made a typo then.

Still odd why the WORD option isn't appearing and also autofill is not working when something like this is tried:
asa(config)# no access-list ACLNAME ?
ERROR: % Unrecognized command

Guess a bug dropped in somewhere between 9.0 and 9.12..

Cheers

Re: ASA 9.12 how to remove an ACL line

ivanDmi — Thu, 21 Mar 2024 22:41:58 GMT

Hi MHM, thanks for your reply. "inactive" didnt make a difference and a reboot unfortunately isn't an option in this environment. However, as suggested in the below response, entering the full "no access-list ...." command blindly works.

Cheers

Re: ASA 9.12 how to remove an ACL line

MHM Cisco World — Thu, 21 Mar 2024 22:44:06 GMT

I glad your issue is solved

And as you mentioned it can be cosmetic bug.

Have a nice day friend

MHM

Re: ASA 9.12 how to remove an ACL line

ivanDmi — Thu, 21 Mar 2024 22:44:16 GMT

Hi AHack210, thanks for your reply. That I tried and ACLs are present and look completely normal.

Oddly enough, entering the full "no access-list ...." command blindly works as expected though. Gonna have to settle for this.

Cheers